Welcome to OStack Knowledge Sharing Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
527 views
in Technique[技术] by (71.8m points)

sql - Syntax error in INSERT INTO statement (vb.net)

I receive an error when I run my project in vb: [syntax error in insert into statement]

Private Sub Bsimpan_Click(sender As Object, e As EventArgs) Handles Bsimpan.Click
    If Tno.Text = "" Or Tnis.Text = "" Or Tnama.Text = "" Or Tkelas.Text = "" Or CBjk.Text = "" Or Tt4lahir.Text = "" Or ttgllahir.Text = "" Then
        MsgBox("Data Belum Lengkap")
        Exit Sub
    Else
        Call koneksi()
        cmd = New OleDbCommand("select * from Anggota where nis='" & Tnis.Text & "'", conn)
        rd = cmd.ExecuteReader
        rd.Read()
        If Not rd.HasRows Then
            Dim sqltambah As String = "insert into Anggota(No,nis,Nama,Kelas,Jenis_kelamin,Tempat_lahir,Tanggal_lahir) values " & _
                "('" & Tno.Text & "', '" & Tnis.Text & "', '" & Tnama.Text & "', '" & Tkelas.Text & "', '" & CBjk.Text & "', '" & Tt4lahir.Text & "', '" & ttgllahir.Text & "')"
            cmd = New OleDbCommand(sqltambah, conn)
            cmd.ExecuteNonQuery()
            Call kosongkan()
            Call tampilkan()
            Tno.Focus()
        Else
            Dim sqledit As String = "update Anggota set " & _
                "NIS='" & Tnis.Text & "', " & _
                "Nama='" & Tnama.Text & "', " & _
                "Kelas='" & Tkelas.Text & "', " & _
                "Jenis_kelamin='" & CBjk.Text & "', " & _
                "Tempat_lahir='" & Tt4lahir.Text & "', " & _
                "Tanggal_lahir='" & ttgllahir.Text & "'"
            cmd = New OleDbCommand(sqledit, conn)
            cmd.ExecuteNonQuery()
            Call kosongkan()
            Call tampilkan()
        End If
    End If
End Sub
See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Answer

0 votes
by (71.8m points)

It might be a character in your values that could create an invalid sql statement. However, generating an sql statement with a concatenation of user inputs is a very dangerous and evil thing to do because it open the door to a simple, well known and well documented security issue called SQL Injection.

The only good way to handle parameter is with parameterized SQL query.

See this SO question for more details.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome to OStack Knowledge Sharing Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...